Analysis and opinion by Christopher Soghoian, security and privacy researcher.

Friday, September 22, 2006

TSA Love

I flew from Indianapolis to Washington DC yesterday. Given that my flight was pretty early in the afternoon, and with a fairly free schedule, I figured I'd take John Gilmore up on the public challenge he issued earlier in the summer, and try to fly without my ID.

I arrived at Indy airport at 4:30ish, walked straight to the computer-easy-checkin machine that Northwest had at the curbside, inserted my credit card, selected my seats, and then promptly recieved my boarding pass. A friendly Northwest employee assisted me with the touch-screen which needed to be pressed rather firmly, but didn't ask for any ID.

Score. With my boarding pass in hand, I walked to the security checkpoint for the northwest terminal.

However, before I could get to TSA, I had to pass the 3rd party contractors who check ID/boarding passes. I walked up to a friendly 70 year old woman with a uniform on, gave her my boarding pass, and told her that I was declining to show ID. I didn't want to make her life too difficult, and asked her if I could speak to one of the TSA officers.

It seems that these guys are paid by the airlines, and not TSA - and as such, their responsibility is to the airline paying them. She had been told not to let people past without an ID, or a boarding pass stating that they didn't have an ID, and so she walked me to the Northwest checkin counter.

There, I spoke to their head supervisor. I explained what I was doing, that I was exercising my right to not show ID, and that I would be happy to undergo secondary screening. She was really nice, and told me that in the future, I should just tell them I had forgotten my ID (as there are standard procedures to deal with this). She had one of her employees print me up a new boarding pass which clearly listed me as "SSSS" - which is their lingo for Secondary Screening Selectee.

Armed with this new boarding pass, I was ushered into a special line at the TSA checkpoint, allowing me to bypass all the other people in line. Not bad! As I approached the x-ray machine, the words "We have a number 2 coming" were echoed down the line of TSA employees. It seems that SSSS = Number two.

In general, I tend to refuse to be screened by the fancy GE entryscan machines - the high tech gadgets that shoot air at you, and then analyze the particles which it dislodges. They freak me out, and I consider them a intrusion into my private space. After all, you never know what they're checking for, in addition to bomb making chemicals.

I declined to go through the easyscan machine as normal, and was mid-way through being hand-searched by a TSA guy with a hand-held metal detector when a supervisor came over, and informed me that as an SSSS selectee, I didn't have the right to decline the GE air-shooting machine. I could either submit to a search by the machine, or I could not fly. If I had any objection to this choice, he would be happy to summon a police officer who could explain it to me.

I could easily see that this could turn nasty, so I took down his name, got the business card of the TSA customer service person assigned to Indy airport, and consented to the creepy air-blast search.

Once that was done, they moved on to searching my bags...

The only thing worth mentioning, is that I had brought a bottle of personal lubricant (i.e. KY Jelly) - after seeing it on the TSA website as one of the medical necessity liquid items that you're allowed to bring.

During the rather extensive search of my bag, they of course found this.

The exchange went something like this:

TSA screener: You can't have this sir.Me: I checked the TSA website, it says I can have 4.0oz of KY. That's 3.8. It's allowed.TSA screener: I'm sorry sir, no liquids.Me: Please get your supervisor.

The supervisor arrives..

Me: I checked your website, and this is on the list of approved items.TSA Supervisor 1: No. You are not allowed to take it onboard.Me: But the website....TSA Supervisor 1: The sign over there says no liquids. That means no liquids.Me: Can I speak to your supervisor?

Finally, a 2nd supervisor arrives:

Me: I checked your website. It clearly states I can have this. Why am I being forbidden from taking it on?TSA Supervisor 2: That is for items of medical necessity like preperation H.TSA Supervisor 2: What medical necessity do you have that you need KY on board?Me: Are you a doctor? Are you qualified to decide what is and isn't a medical necessity. It's on the website as approved.TSA Supervisor 2 grumbles and then intructs the junior officer to test the KYfor bomb-materials and then let it through.

Success!

In the end, the screening process took about 10 minutes - it was quite interesting to see them all at work. I successfully boarded an airplane without showing a single piece of ID to anyone at the airport, and managed to get bottle of sex lube ontothe plane without TSA taking it away.

I've emailed the TSA customer service rep to get a clarification on the SSSS/mandatory air-blast test issue, and to also find out why all of the TSAstaffmembers are not aware of the list of approved liquids.. I'll update the blogonce I hear back.

7 comments:

I'll be interested to see your results. I appreciate what i know of John Gilmore's use of both systematic approaches (legal methods) and practical ("extra-legal" methods). I'm wondering, Chris, about the purpose of your exploits. do you see them as exploratory, to force reform, or for some other purpose?

Do you have ANY idea what would happen to Gretchen should she attempt this? They'd probably find some sort of medical waste left in her hip from her accident and declare HER a bomb...or something worse.

Christopher Soghoian, Ph.D. is a Washington, DC based privacy and security researcher. He is the Principal Technologist in the Speech, Privacy and Technology Project at the American Civil Liberties Union.